Slashdot videos: Now with more Slashdot!

View

Discuss

Share

We've improved Slashdot's video section; now you can view our video interviews, product close-ups and site visits with all the usual Slashdot options to comment, share, etc. No more walled garden! It's a work in progress -- we hope you'll check it out (Learn more about the recent updates).

Trailrunner7 writes with this from ThreatPost: "Researchers have made a huge dent in the Pushdo botnet, virtually crippling the network, by working with hosting providers to take down about two thirds of the command-and-control servers involved in the botnet. Pushdo for years has been one of the major producers of spam and other malicious activity, and researchers have been monitoring the botnet and looking for ways to do some damage to it since at least 2007. Now, researchers at Last Line of Defense, a security intelligence firm, have made some serious progress in crushing the botnet's spam operations. After doing an analysis of Pushdo's command-and-control infrastructure, the researchers identified about 30 servers that were serving as C&C machines for the botnet. Working with the hosting providers who maintained the servers in question, the LLOD researchers were able to get 20 of the C&C servers taken offline, the company said."

Don't know if you got the memo, but the feds pay others to do the dirty work for them.

Fed: "Wanna work with the FBI, Fido? Wanna help us catch bad guys?"Snitch: "Yeahyeahyeahyeahyeahyeah!Fed: "There's an athiest group that looks suspicious. I think they're laundering money to fund their picnics. You need to infiltrate them, earn their trust, and if you don't find anything make something up so we have a good excuse to raid their headquarters. You will get a pat on the head and a nice, big doggy bone if we get convictions.Snitch: "Yeahyeahyeahyeahyeah!

[ Months later, a number of the atheist group's members are arrested for child pornography for unwittingly having nude pics of their 17 year-old sons and daughters who kept them stored "privately" in facebook ]

Fed: "Bad news, Fido. The D.A. wants to charge you with computer crimes. You're expected to do 5 years in the pen."Snitch: *whimper*Fed: "It's okay, you helped us save the children. Just suck it up and don't drop the soap."

I'm sorry to be the one to tell you this, but your little 'story' is very reminiscent of the ABC After School Special "When Good Dogs Do Bad Things (And Hard Time) For Good Reasons". Be on the look out for a little 'invitation' to a court party being held in your honor thrown by the ASSAA and their affiliated legal teams.;-)

There's no legal authority for the courts to order such actions. Even execution orders are authorized by the legislative body, approved by the chief executive, and carried out by subordinates to the executive (subject to the lack of intervention by the judicial body). Any offensive action against spammers/hackers would require a similar path.

If it hasn't happened already - how long before they control the biggest botnets on the block (they being "security intelligence firm's"), to meet the Cyber-defense budget laid down by American taxpayers. Personally I prefer to setup a few spam filters on my servers over having Goverments use their shady "security intelligence firm's" to take websites like wikileaks offline.

So I could switch to those providers, and know they wouldn't be messing with my server without talking to me just because some er "researcher" decided they thought the server might be some sort of C&C

I assume that the providers were just notified by the researcher and were able to see for themselves whether the server is doing something malicious or not. In addition every ISP I've dealt with, has a contract clause that allows them to cancel the service if you use it to violate the laws of the country - which is often the case when sending SPAM. You are then free to sue them if you believe that terminating the service was not justified.

I assume that the providers were just notified by the researcher and were able to see for themselves whether the server is doing something malicious or not.

And when they look into it, they'll probably see a bunch of SSL-secured HTTP requests.

In addition every ISP I've dealt with, has a contract clause that allows them to cancel the service if you use it to violate the laws of the country - which is often the case when sending SPAM. You are then free to sue them if you believe that terminating the service was not justified.

A command and control server doesn't send out spam. It only acts as a server for the bots that do all the spam sending.

A command and control server doesn't send out spam. It only acts as a server for the bots that do all the spam sending.

Replace "send out spam" with "store pirated media" and "command and control server" with "torrent-indexing website", and you essentially have the same argument for not interfering with their operations.

Replace "send out spam" with "store pirated media" and "command and control server" with "torrent-indexing website", and you essentially have the same argument for not interfering with their operations.

Replace "send out spam" with "store pirated media" and "command and control server" with "torrent-indexing website", and you essentially have the same argument for not interfering with their operations.

They've done that ages ago. In case these researchers actually did had taken down all the C&C servers, the bots would go into rendezvous mode and based on an algorithm, start generating thousands of domain names per day. Now all the people behind the botnet need to do is to register one of those domains and upload their signed update on it with a list of new C&C servers, and the botnet is back up and running.

These aren't some 90's irc botnets and the people running them aren't stupid. With these met

And, like an incomplete antibiotics therapy, it gives the botnet's herder a clue -- that he needs to move to more resilient techniques instead of relying on fixed, easy to remove, servers.

So... why do they? Wouldn't it make more sense to make the whole thing entirely decentralized, with each bot keeping the addresses of a dozen or so other bots, and broadcasting any incoming commands (that pass the signature check, of course) to them? The bot herder simply runs a bot in his own machine, and injects any com

It's certainly better to block the server by having the ISP take it down, but there are other ways to do it.

Other ISPs can block IP addresses or address ranges from accessing their users, and getting the few big cable modem and DSL providers to block the botnet's servers doesn't require cooperation of the ISP hosting the servers. (The inefficient way to do blocking is to use Access Control Lists; it's simpler to just route the addresses to a blackhole.)

Well if you had read the article you would have been sure. if you are going to make a comment about something at least spend the 5 seconds it takes to scan the article to see if you are just plain wrong.

Wait, so I wont be getting any more exciting opportunities to add inches to my penis? What about all that steady income I was getting helping out Nigerian bankers!?!? How am I going to feed my family and satisfy my wife?

Seriously, guys, why does nobody ever link to the original source? ThreatPost [threatpost.com] got it from M86 Security [m86security.com] got it from TLLOD [tllod.com]. Would it kill the submitters to link to the original, or the editors to fix it?

I think we need to start having more of a "you play nice or don't play on the net" kind of system going on. Providers are not expected to be perfect, nobody is perfect, just to be responsive to complaints/problems. If you aren't you get warned and if you keep ignoring it you just get shut out by all major networks. You then have to prove you took care of the problem and will play nice before you get let back in.

That's how we do it at work, actually. I work at a university and we have a lot of research labs, some of which are totally independent of our central control. When a system in there gets infected, we see if we can track someone down who can deal with it, if nobody is there or everyone claims ignorance, we shut down all network access. When that happens people get a hold of us surprisingly fast and the person who needs to deal with the system is found. Once they take it offline to be dealt with and promise to behave, network access is restored.

I think the big network providers need to work out a system like this, where if a given company is unresponsive, you can file a complaint with them. They then warn the company and if they are still unresponsive, cut access. After all the crap causes them problems as well.

The Internet is a default-accept network. Changing it to a default-deny network would have far-reaching consequences way beyond taking down spam networks. Which would you rather have, the internet of today or "we'll shut you down or else" decisions being made by drunk-on-power nerds?

Doesn't sound like he was proposing a default-deny network, just proposing actual consequences for breaking the law (which in most jurisdictions requires the disconnection of illegal servers upon notification)

I'm proposing that people deal with their own dirty laundry, and if they won't, that the people above them do. For example if I am causing a problem, my ISP will call me and say "Hey fix your shit." Happened many years ago, a roommate got a virus on his computer. They called me, I turned it off, life was good. Should I refuse, however, the ISP would have shut down my line. They were not interested in sending out viruses all over the place.

What I'm proposing is that the big bandwidth providers take the same attitude. If some hosting provider has systems doing evil, you contact them. However if they refuse to deal with it, you can then contact the big providers. They can check, if evil is going on they warn the company. If it doesn't stop, they shut down the links.

I fail to see a problem here. Such a thing wouldn't be done capriciously because it is against a business's best interest. If a customer is paying money and not causing problems of course they want to keep the connection active. They don't want to turn it off for fun (and probably break the contract).

All lines have AUPs, even big ones. I just think they need a mechanism to allow for complaints and enforcement, and something that is less severe than a total disconnection. Rather than something having to get to the "You cause so much trouble you are in violation of the contract and we stop selling service to you," point instead they can say "You've refused to deal with complaints so you are blocked, fix your shit and promise to listen in the future and we turn you back on."

The reason I want to see this is first because I want less shit on the net, but also because with many things you find you either self regulate or the government will regulate you. What happens if instead the US government, or a council at the UN gains complete regulatory power and can tell providers who to shut down? I'd much rather have it as a self regulating system.

It works well for ISPs, and most ISPs do it. As I said, as a university we are an ISP and we do just that. We investigate and respond to claims of malicious network activity. However, we need a higher level to deal with the ISPs that won't respond to the complaints.

I don' t think that will work so well. The C&C machines are on ISP's who are peered with major ISP's that are much more interested in money than the small amount of traffic coming from C&C. The individual zombie nodes are so distributed that the labor costs of properly determining whether a down stream client is infected, or is not being dealt with fast enough far outweighs the costs of shutting down the network to that client's ISP/owner.

The main problem there is that back in olden times people pretty much had to know things about computers to get online. These days not so much, anything more complicated than turning it on or accessing the internet (By which I really mean IE) is deemed to be too complicated and time consuming to worry about. And no amount of nagging or information seems to be able to penetrate their minds that it's a very serious risk with potential life changing consequences.

Your proposal would work best, to be honest, if the major backbone providers did this to the entire ISP instead of leaving the ISP to half-assed "police" its members. If a large amount of spam is coming from a provider, shutting it off entirely will get them to comply with their terms(which I can guarantee has terms and conditions concerning malicious use and so on). It's currently entirely within their bounds to do so but to date, they still refuse to do it. It's also not rocket science to see where the

That's sounds very scary. Who defines what "nice" is? You assume that people are good and won't redefine "nice" to "anything I don't like".

You mean like those who have mod points on/.?

The problem with the somewhat narrow-minded "let's just go vigilante on the bad guys and forget all laws" approach is that it can (and will) be easily abused.

I guess it would require us to pick our poison. Deal with an ISP that gets to deny access if they think you're doing something wrong (besides exceeding undefined bandwidth limits, running a small web server at home, etc) or deal with botnets flooding the internet with spam, malware and all the associated traffic it generates (which uses up some of that precious bandwidth).

It could get messy if a large backbone provider cut off access to a large or mid-sized IS

And you surely would like it if your business comes to a screeching halt, just because you happen to have your server hosted by a provider who also hosts a server which some researchers claim to be a botnet server, and your provider doesn't believe them.

I'm sure there aren't many companies that would put up with that at all. That's why it would be so effective; not many ISPs would remain in business if they failed to protect their customers from such shut-offs.

How exactly would they check it out? Check that there are indeed bots contacting your server? It should not be hard for the criminal to add your server to some bot's list of servers to contact (the bot will not get any useful response from your server, but that's no problem, the bot will simply ignore any useless replies). How is the provider to distinguish https requests which return useful commands for the botnet from https requests which don't? Note that any user-facing web server handling confidential d

You have an alternative? An obscene amount of this sort of traffic is served up by a small number of providers. Usually offshore where the authorities don't care and they aren't the kind of ISP that businesses would typically want to be hosted by because any ISP that looks the other way while cybercriminals and in some cases organized crime runs amok, could very easily not notice somebody stealing your data.

This reminds of a story that may be more tech myth and legend and if it is not true it should be and it goes something like this:

Back in the early days of the net when the major interconnects were MAE East and MAE West and other interconnect points had not been established almost everything routed through these two points.

So the story goes that there was a tech who dutifully monitored the system during his shift. He had noticed that someone from another country was trying to get access to files on a certain server at major university. Now he was curious because he saw the same attempts over and over again over a rather long period of time. Now since we all forget password or thing we know them and then try and try without success this is not that unusual and normally after fumbling around we will just contact the machines owner and ask for the correct password. Now in those days it was still a relatively small group of folks so there were not a whole lot of questions asked.

But the tech in question started noticing the pattern was limited to times when the people attending these machines would not be there.

So he sent off an e-mail to the admins he knew and they had not been requested to change or provide any passwords.

So our intrepid tech sent off an e-mail to the administrators of the location of the seeming intruder and asked that they have him stop. Well the admins said that it was really none of their business anyway and being in a foreign country our admin had no say over what anyone there did. The long and short of it was that the apparent intruder kept it up.

So one night our intrepid admin had had enough, so he did what he thought might get peoples attention. He simply unplugged the cable that was the source of the problem and effectively disconnecting an entire country from MAE West!

Well in a few hours phones started ringing into MAE West asking questions and trying to figure out what was wrong? He told them he had asked, many time for the admins of the network that the rude behavior was originating from to kindly ask the owner of the machine to stop and had been rudely rebuffed to say the least.. He also said when the attempted intrusions stop, he would plug them back in. To say the least they stopped in fairly short order and he plugged them back in.

Now that is a bit far flung because I doubt there is any one cable that could disconnect an entire country but I am pretty sure you could simply route class A's to/dev/null. Perhaps that what it will take to get ISP's to get serious. Just pull their plug until they behave. Everyone peers in someplace so it should not be that hard to go and find that Ethernet cable and simply unplug it and leave it dangling until their behavior changes/

pretty sure I was infected and windows update dropped me an updated malicious software removal tool and cleaned it up. I was having that wacky mouse button behavior, couldn't click to login, clicks closed chrome tabs, and more. some reports say it was the result of an infection, which you could remove with spybot in safe mode. I didn't even get that far (it's just my entertainment PC, and it's not a big deal if someone knows what I watch on netflix) before Microsoft fixed it for me. Well, as far as I can te

What about all the spam it was hammering out? As soon as you believe a machine to be infected the honorable thing to do is unplug it from the Net until you can fix it.

It wasn't actually hammering any (significant volume of?) spam out. I can see my bandwidth use, I have a monitor on the single point of in/egress. Pretty sure it was some kind of spy from its interference with input.

I seem to be missing something here. Somebody please remind me what Windows Malicious software remover and all those antivirus programs are supposed to be doing.

The biggest problem is people not using them - not using automatic windows update (or very frequently manual) and not having up-to date malware and antivirus (it's free [microsoft.com] and some, like this one, are not the resource hogs fx old Norton was infamous for.)

Nothing is 100% secure, but boy to this take care of most of it, as you correctly are saying (when I turn my sarcasm detector off:)

fx Windows had actually Conficker patched quite early, in Windows Update, it became the big ongoing epidemic because of unpa

(people not doing auto- or frequent updates, for some reason or other).

Among the reasons for not doing auto updates are patches from Microsoft hosing your system.

A couple of personal examples:

An update to IE made it impossible for ANY program to access the internet with that computer. Why an IE update was able to block other programs was never clear but shows why the integration of programs for marketing reasons is a bad idea.

Another one "updated" a driver for the motherboard to an older version t

malware removers are great, but they're only a portion of the solution. A proper firewall, sandbox, antivirus and anti-malware is really the bare minimum needed on Windows. Beyond that you need common sense, vigilance and some knowledge of security. The problem is that it's a relatively small number of people that actually go that route.

They have been studying this since 2007 and now, three years later, have only managed to take 20 of the 30 control servers offline. Good work, to be sure, but it's not even a dent in terms of amount of malware stopped. How many other worms/viruses have been created in the past three years that are still running? And how much work would it take to bring Pushdo back to full force? Put some other C&C servers online and push out an updated list through the current C&C servers.The only reason this wa

Concievably, the methods used by these researchers could be examined within their particular community (meaning, in this case, other research labs/firms seeking to eliminate these sorts of threats), and with greater analysis and numbers behind the existing data, adaption and use of this research could be utilised--in an accelerated timeline--against other botnets.

That said, will the war ever truly be won? Very likely not; hackers, malware authors, and the like will continue to get more ingenious, which wi

Stupid people would be stupid on any OS. There is no reason in the world to suspect that if Windows disappeared that virus/malware creators would shrug and go "Oh well, we're fucked, guess we find real jobs," or that stupid people would suddenly go "Gee, that document my friend sent me is asking to install a program, that doesn't seem right." As long as you insist on "It's a Windows problem" rather than "It's a user education problem" the battle will never be won.

The battle won't be won because stupid people insist on running Windows and running every attachment mail their way and every pirated software they get from warez sites.

Funny, that. I'm a Windows XP user, and I download quite a bit of questionable software but I haven't had any virus for the last couple of years. The problem is not with Windows, the problem is with stupid people. A bit of education would easily reduce the size of botnets a lot.

The battle won't be won because stupid people insist on running Windows and running every attachment mail their way and every pirated software they get from warez sites.

Funny, that. I'm a Windows XP user, and I download quite a bit of questionable software but I haven't had any virus for the last couple of years. The problem is not with Windows, the problem is with stupid people. A bit of education would easily reduce the size of botnets a lot.

How can you be sure? Botnet viruses try to make themselves as unnoticeable as possible.

Correct me if I'm wrong, but wouldn't adding new C&C servers be as simple as pushing an update to the bots? If there are still remaining C&C servers to update with (let alone still a third), that should be pretty routine for them.

Shutting down 20 out of 30 servers seems worse than useless to me. If you need to get all 30 at once, all that has been achieved is that they're back to square one.

Correct me if I'm wrong, but wouldn't adding new C&C servers be as simple as pushing an update to the bots? If there are still remaining C&C servers to update with (let alone still a third), that should be pretty routine for them.

Not in this case. This botnet apparently can spread other client side malware, but doesn't attempt to infect new servers.

That's a very hard problem and I guess that's good.

New servers can be added manually though. Part of their protocol involves the client receiving updated lists of servers. That's why even though this was first detected in 2007, had the servers attacked repeatedly over the years as in this article, the botnet is still around.

We don't know what really went on. Maybe the botnet operators have a second botnet, and after detection of the attack they decided to temporally only use the other one in order to make the attacker think the attacked botnet were dead and lose interest in it.

"Cripple" sounds entirely too optimistic. Maybe "somewhat inconvenience" is the right term here. C&C servers can be added easily, if the design is right. In fact, if the operators know their business, they will have standby-servers that can be activated within minutes.

And again some "security researchers" vastly overstate their success. I find that highly unethical.

No, you aren't. I don't know why people working in IT security have the ego to always add the word "researcher" to their title. Just because your job involves problem solving it doesn't mean you're a "researcher" as the term is understood everywhere else. Anyway, where does your R&D budget come from for this team of "researchers", and what do you get back?

at Last Line of Defense

Who? So many overgrown hax0rs slapping a stupid name on their activities and calling themselves a business, using inflated claims of leet-sounding ach

I wonder why the police did not just add spying logging equipments, kept silent and followed wires (IP addresses ) and money transfers. (obviously, someone paid for the servers, even with stolen cards). Shutting down 2/3rd of C&C is like 2/3rd done job. The organized crime behind this is still runing fine.

My guess would be that people running large botnets do not tend to contact hosting providers and pay for a years' hosting with a legitimate credit card which they own and is registered to their home address.

That's not even a problem for law enforcement to deal with. they can track fake cards and fake addresses, that part is easy and done on a daily basis.

The hard part is that the people running large botnets aren't kind enough to run all the control servers in a single jurisdiction that a) has the appropriate laws to do something, b) has the resources to do something, and c) cares to do something.

Like any other business they shop around for countries with laws favourable to their business model.

You certainly could, but that is not what was being discussed by the OP here (that was discussed by a different poster further up) The OP here was asking why the police haven't solved this, and that is what I answered.

The idea of null-routing at the other end of the pipe has a lot of merit, but is unfortunately not something that the big providers are willing to do it seems, they are more interested in the $$$ coming in than the cyber-crime they are enabling.

Unfortunately, the rumors were greatly exagerated. The nukes didn't find their targets, because the folks who identified the servers were so unkind that they didn't publish the IP addresses^H^H^H^H^H^H^H^H^H^H^H^H coordinates